Uygulamalı Mirror Trafik Analizi ve Pcap Verileriyle Tehdit Avcılığı
Sanal bir laboratuvar ortamında:
🛠️SPAN/Mirror trafik mantığının gerçek hayattaki karşılığı
🚨PowerShell ile ICMP Tunneling kullanılarak gerçekleştirilen veri sızdırma simülasyonu
🔎Ve en önemlisi; Wireshark ve tcpdump ile bu zararlı aktivitenin (threat hunting) adım adım analizini anlattım.
https://t.co/1bnKkyy9J5
🚨 AI-Powered Decision Support for SOC 🚨
Death from Thousands of False Positives? Alert fatigue is the silent killer of SOC efficiency.
To solve this bottleneck, I designed and implemented an AI-powered Decision Support System natively integrated into Cortex XSOAR. Here's how I went beyond static rules.🤖🛡️
Instead of relying on hard-coded logic, the architecture I built uses a custom NLP approach to dynamically analyze historical event data. ⚙️
By leveraging TF-IDF and cosine similarity, the system evaluates the payload, common words, and context of an incoming alert against thousands of historical records to find the closest matches. ✅
As you can see from the images, it applies both simple and weighted scoring algorithms to these matches. This tool predicts the causes of closure (such as false positives) with high mathematical probability and even intelligently directs the case to the most qualified analyst based on past QA pass rates. 📊🧠
If you are working on Detection Engineering, SOAR Automation, or applying Machine Learning to Security Operations (SecOps), this will be useful for you.🚀
You can access my full Medium article here: 👇🏼
🔗https://t.co/gE9FHetEke
#CyberSecurity #XSOAR #SecOps #DetectionEngineering #MachineLearning #AI #Automation #SOC #PaloAltoNetworks
Excited to share my new project: AttackRuleMap
This project maps #AtomicRedTeam simulations to open-source detection rules like #SigmaRules and #Splunk ESCU rules (maybe more in the future).
Currently for Windows, with plans to support more platforms.
https://t.co/O52271h4BW
I was tired of dealing with dozens of emails and RSS feeds every day to keep up with cybersecurity news, so I created something serverless to automate the entire process. 🐍🤖
https://t.co/zRPd3GlLmq